Alerting
Highlighted

What capability is required to be able to execute a shell script when an alert is fired?

Path Finder

I cannot run a shell script as part of my alert. It is clear that I need my user to have a particular splunk capability - when I add the "admin" role, I am able to run my shell script, without "admin" role, I get an error saying it can't find search "runshellscript"

What splunk "capability" is required to run a shell script??

0 Karma
Highlighted

Re: What capability is required to be able to execute a shell script when an alert is fired?

Contributor

Hi.. I don't think there is a specific capability requirement to allow scripts within alerts. As along as "schedule_search" capability is allowed for the role. The users within that role should be able to setup script for alert actions.
There is very good documentation for setting up alerts here
Some info on troubleshooting here

Hope the info resolves your current issue.

0 Karma
Highlighted

Re: What capability is required to be able to execute a shell script when an alert is fired?

Path Finder

I'm able to schedule the alert, but when the alert is fired, the 'runshellscript' search term can't be fired. But when I add role 'admin' to my user, I don't get the error and 'runshellscript' is runnable.

Hence my suspicion that my user is lacking a 'capability'.

0 Karma
Highlighted

Re: What capability is required to be able to execute a shell script when an alert is fired?

Contributor

Ah.. reasonable suspicion. The list of offered capabilities is not that long .. and nothing seems to jump out pointing to this specific retirement (for me). So if you set any other kind of alert (email for eg).. does it work (without needing admin role)? What are the permissions on the script?

0 Karma
Highlighted

Re: What capability is required to be able to execute a shell script when an alert is fired?

Path Finder

The capability "edit_scripted" is required to use the "runshellscript"

I don't see where splunk documenation states this but via trial and error (in v6.2.2) it is indeed the case.

View solution in original post